CVE-2006-1128

CVE-2006-1128 describes a directory traversal vulnerability in Gallery 2 versions up to 2.0.2, specifically within its session handling class (GallerySession.class). This flaw allows remote attackers to access and delete arbitrary files by manipulating a cookie-supplied session value, which is unsafely incorporated into file paths. The vulnerability carries a CVSS score of 6.4, indicating a medium severity risk with low attack complexity and no authentication required, potentially leading to partial confidentiality and integrity compromise. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry exists, and the CVE has received minimal community discussion or media coverage.